chore(sync): align rookery with judge monorepo subtree#277
Merged
Conversation
Brings rookery up to date with the judge monorepo's subtrees/rookery (origin/main) — commandrun v0.2 producer + signed key-guard evidence + all-env eBPF sentinel, evidence-based SLSA verdict, policy verify/validate UX, attestor skip-hints, and the consolidated keyless/auth work. Preserves rookery's cilock.dev release pipeline (the #270/#272 fixes judge had not yet synced): release.yml uses --step release-build (collection name matches the policy step), install.sh uses 'cilock version', and release.policy.json uses native aflock.ai types + jwt.claims rego — with command-run bumped v0.1 to v0.2 to match what cilock now emits. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Aligns
aflock-ai/rookerymainwith the judge monorepo'ssubtrees/rookery/(judge
origin/main), bringing rookery up to date with everything the monorepohas developed since the last full sync (rookery
#252/afea23b3), whilepreserving rookery's own cilock.dev release fixes that the monorepo had not
yet synced back.
This is intended as the final reconciliation PR before rookery becomes a
release mirror of the monorepo (judge = source of truth; rookery updated on
release).
How it was reconciled
The two trees diverged in both directions since the last sync. I used a
content 3-way merge (base = rookery
afea23b3, ours = judgeorigin/mainsubtree, theirs = rookery
main/#272) and found judge is +6,141 / −475vs rookery — i.e. judge is the superset almost everywhere, having already
absorbed rookery
#253–#269via the monorepo's per-PR syncs. Only 3 fileswere genuinely ahead on the rookery side, all in the cilock.dev release path.
release.yml#270)--step "release-build"so the attestation collection name matches the single policy step (per-arch names surface asErrNoCollections).deploy/cilock/install.sh#272)cilock version(the--versionflag does not exist).deploy/cilock/release.policy.json#270)aflock.ai/*types +jwt.claims.{repository,ref_type}rego (the witness.dev/input.repositoryform was silently vacuous). Bumpedcommand-runv0.1 → v0.2 to match what cilock now emits (V02PredicateType).#5179); no divergence.Verification
cilockandattestationmodules build clean (GOWORK=off go build ./...).cilock/internal/{options,cli,config,auth,policy},plugins/attestors/commandrun(v0.2),attestation/{policy,source}.Follow-up (not in this PR)
After this lands, rookery is intended to be locked to mirror-only (no direct
PRs; mirrored from the monorepo on release).
🤖 Generated with Claude Code